Lack of data validation - Path Traversal In github.com/grafana/grafana
Description
Grafana: Path traversal in the Tempo and Loki data source plugins The Tempo and Loki datasource plugins construct backend HTTP requests by interpolating user-supplied input into URL paths without sanitization, enabling path traversal. A Viewer-role user can: (1) capture admin-configured datasource credentials (secureJsonData custom headers) by traversing to an attacker-controlled endpoint, (2) invoke state-changing admin endpoints on Tempo (e.g. /flush, /shutdown), and (3) exfiltrate internal service data via Loki's CallResource which returns full HTTP response bodies.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 rpm rhel9 | - | - | |
 go | 1.9.2-0.20260616075434-82ef13993059 | ||
rpm rhel10 | - | - | |
rpm rhel8 | - | - |
Aliases
References